Tuesday, December 13, 2016

Cryptomancer: What's Your Paladin's Password?

Never underestimate the power of a good cover. That’s how Cryptomancer grabbed my attention. It looks strong and iconic, not messy and confusing. And then I saw the game’s simple, clear pitch line: fantasy hacking. Hacking what? I wanted to discover. In G+ discussions no one knew. Their curiosity hadn’t pushed them to pick it up. A first-time publisher and complex seeming character sheet worked against it. But I took the dive, and I’m glad I did.

Cryptomancer’s a fantasy game about information security. It isn’t what I expected- it’s better than that. Rather than just abstracting hacking as a series of rolls, it makes the players work for their success. That could have been complicated, but it manage to simplify while providing a rich world that spins out of the magical advances it puts into play.

My review’s based on reading and having run two session for The Gauntlet’s TGIT Hangouts. We recorded the sessions and you can see those here.

Cryptomancer is an rpg about “hacking in a Tolkienesque high-fantasy setting”. In this world, magical developments have massively impacted how people live and how the powerful maintain control. It’s a setting rife with conflict and intrigue. It has some pretty important setting premises and details. You can’t approach it like any other fantasy game. Instead you have to know more about how the world works to make informated choices.

The Peoples (Adapted from the Cryptomancer site descriptions)
Dwarves “Warrior Architects”: Merchants, mechanics, and master cryptomancers responsible for the proliferation of the Shardscape. Dwarven clans leverage the Shardscape to coordinate guerilla warfare against waves of orcs threatening their underground strongholds, as well as participate in the intrigues of the surface world, playing human versus elf to their own advantage.

Humans “The Experiment”: Young race of mortals struggling to reconcile their feudal imagination with the Shardscape, a realm where birthright and conventional power mean nothing. While humans of limited means leverage the Shardscape to establish and organize labor guilds, crime syndicates, and other resistance communities, those in power leverage it to surveil the restless masses and control them though propaganda

Elves: “Sylvan Parasites”: Industrialists who decimate great forests to harvest soma, a highly-coveted and profitable commodity. Elven tribes leverage the Shardscape to manage their soma supply chains and control massive swaths of forest otherwise impossible to hold with their limited numbers.

All three peoples are highly factionalized internally.

Who Are The PCs?
To set this up, you first have to understand about The Risk Eaters. They’re a secret cabal of powerful mages who consider themselves the protectors of the realm. They want stability above all else. To do this they consult calculation engines to read fates. If something or someone has or will upset the balance, they deal with them via assassinations, market manipulations, puppet regimes, or levelling city-states.

The PCs have been marked as a future threat. Why? Unknown. The Risk Eaters now hunt their steps, forcing them underground. They operate as a cell of agents on the run, acting against this oppressive regime.

Two magical developments have connected this world: Cryptomancy and the Shards.

Cryptomancy: Basically, anyone can encrypt a communication into a cipher with a keyphrase. That encrypted communication appears as “clear text” for anyone who has heard, read, or spoken that phrase in their lifetime. When this happens, the subject become aware of the keyphrase so they can pass it on. Everyone wants unique keyphrases to prevent others from decoding them.

Alternately a person can encrypt using a True Name and Soul Key. Everyone has both, but the only the bearer can share their True Name. Soul Keys cannot be passed. When someone hears a communication encrypted with their True Name, it decrypts. The reverse holds true: something encrypted with a Soul Key can only be decrypted by someone who know the associated True Name. True Names are highly valuable then, but the more people who know it, the greater risk of it being mishandled.

A Cryptomancer cannot magically encrypt an already encrypted communication. However, they can encrypt a conventional code. So an agent might encode a phrase that has a particular meaning for the recipient.

Shards: Magical crystals into which users can project or receive communications. When they do so, they can send to or read from any other Shard cut from the same stone. These sets are called shardnets. This happens instantly and over any distance. Communications leave “echoes” which last a number of hours equal to the number of shards on the network. Bearers can use Cryptomancy with a shardnet, via thought rather than speaking. A shard must be held in hand to be used. This is an obvious and visible action.

Other Interesting World Details
  • Secure shardnets usually have cryptoadmins who check and oversee communications. They may have several shardnets they coordinate. They may also bridge shardnets by holding two different shards. Sometimes they’ll have a keyphrase for particular networks.
  • Massive constructed golems can be used to connect and administer shardnets.
  • Cryptoadmins usually have a secret registry containing lists of valid users, schedules, and passphrases. Good cryptoadmins track any and all messages left in their shardnets.
  • Couriers carry posts between locations, posting them on communal Message Boards. Encrypted messages can then be read by those in the know.
  • True Name cryptosigniatures are often used to secure legal documents.
  • There’s a massively accessible shardnet, simply called the Shardscape. It has so many fragments, echoes remain there insanely long. Searching through the echoes takes time.

Cryptomancer uses a unique resolution system. It isn’t quite like anything I’ve ever played. It took some getting used to. At heart it’s a skill-based system, with skill ratings derived from stats. You roll a pool of dice looking for successes, but…

Characters always roll 5 dice for any test. They roll d10’s equal to their skill rating. Any remaining dice use d6’s (called fate dice). Any dice which meet or beat the difficulty number count as a success. A 6 on a fate die always counts as a success. Everything has one of three difficulties are: Trivial 4+, Challenging 6+, and Tough 8+.

BUT then they must knock off successes for each “1” rolled on the d10’s or “1 or 2” on the fate d6 dice. These “botches” can hit hard. If characters get -2 or fewer successes, that’s a dramatic failure and horrible things happen. -1 success means they simply fail and 0 successes means a failure with a silver lining. If someone only gets 1 success, they do it but with complications. With 2 successes characters do it cleanly and with 3 or more awesome things happen.

Players have two ways to deal with Botches. Some talents allow a character to ignore one or more for particular checks. They can also choose to ignore all the botches on the fate dice (the d6’s). If they do so, they increase the group’s Risk. I’ll come back to that.

Characters have four core stats. These can have a value of 4, 6, or 8. Two attributes derived from each of those core stats. Those go from 1 to 5. You decide what you have by dividing the core stat number. So with a 6 Power, a player could split the values 1&5, 2&4, or 3&3 among the two attributes
  • Power: Strength & Endurance
  • Speed: Agility & Dexterity
  • Resolve: Presence & Willpower
  • Wits: Knowledge & Cunning

Six of the eight attributes have associated skills. Willpower and Endurance do not. They’re used for magic and health respectively. Skill is equal to the attribute it’s under. These don’t increase, but players can buy talents to make them better with these. Everyone can roll for any skill.

The core stat has another big purpose. It sets the target number when someone tries to affect a character in that area. It’s clever, clear, and means you generally don’t roll opposed checks.

When someone attacks, they roll against the difficulty of the target’s defense. On the character sheet, defenses are listed next to the core stats in the big circles (Take Cover, Dodge, Parry, Resist). A higher number is better.

Cryptomancer has a novel way of handling initiative. Whoever says “I attack” goes first in a combat. That side goes, then the other. But once they say, “I attack,” they’re committed, even if it turns out to be a bad idea (like the person who emerged from the shadows actually came to help).

Damage is # of success plus any bonus from the weapon. If a character takes 3 HP in a hit, they’re in bad shape and bleed 1 HP if they act and move in a turn (Critical). If they take 4 HP in a hit, they just bleed 1 HP per turn (Mortal). Consider that everyone has HP equal to their Endurance +5, so no less than 6 or more than 10. That means combat can be pretty lethal and fast.

The system has a number of other combat tweaks. For example, sneak attacks add Stealth successes to damage. There are Grapple rules. But overall it doesn’t feel overwhelming. It helps that it takes a simple approach to things like weapons and equipment.

These primarily have descriptors for color, but some also give a mechanical effect. But mostly they offer a nice hook for the fiction. Armor also has descriptors—the important ones are Light Deflection (ignore 1 HP wounds); Heavy Deflection (ignore 1 or 2 HP wounds); and Damage Reduction (reduce damage by 1).

Talents cover conventional feats characters can use. The character sheet marks that out in an interesting way. A filled-in triangle beside a skill means the PC has an associated talent. It reminds the player to check that in their talent descriptions. Magic comes in three levels, measuring power and reach. Anyone can learn magic. Spells generally require a Willpower test. Spells cost MP.

When you try out a game in with a one or two shot, you inevitably miss some portion of the rules or setting. Cryptomancer contains a ton of long-term ideas and resources, concepts we didn’t get to the table in our session. It’s built as a extended campaign with players making investments, developing resources, and digging themselves in deeper.

Cryptomancer contains decent rules for handling “off screen” actions. Many of these focus on the creation side of things. Downtime’s roughly an eight-hour period, an important consideration when the group’s working against the clock. It has rules there for healing, learning, brewing potions, crafting items, developing social networks. Finally there’s “Following a Lead.” That’s represents research and recon, done with a single roll to gain a clue or piece of info.

That’s an interesting move. It doesn’t mechanize the “legwork phase” of the game as much as The Sprawl does. But that downtime choice feels like a mechanic to handle players who don’t want to play things out and instead want to go to the dice. Alternately, you could read it as a “hit the streets” action (something we’ve seen in some PbtA games, including Worlds in Peril). Essentially a move for when the players feel like they’re stuck or directionless. That’s how the book presents it. Since this only gains players simple information, it suggests actually playing out the scene allows for more information. I’d have to think about how I want to handle that. The book suggests a minimum number of successes to gain info. I’m not as keen on that. I prefer a more GUMSHOE approach: key information given for the work, plus additional info for successes or additional costs for failures.

Strategic assets
Cryptomancer has a conventional advancement system. You can learn spells or add talents. “Narrative gaps” between campaigns can be used to raise attribute ranks. But jobs and challenges also pay off with strategic assets. The group can spend this to improve their organization. These can go to three things.
  • Safe Houses: There’s a sheet for tracking the group’s safe house. By default it provides a secure location for the PCs. They can also improve that by adding new rooms and facilities: an alchemy lab, a cryptoadmin, a library, a training room and so on. They can also buy a “transfer” of the safehouse improvements if the team’s location or situation drastically shifts.
  • Cells: The network of contacts and operatives the group can call on. These include scouts, agitators, cleaners, unlikely allies, and beyond. Players have to choose if they keep particular cells at a distance, making them deniable, or close, making them tied to the group. The latter approach gives the cell more skill dice to roll.
  • Mounts: Useful transport for the group.
I mentioned the Risk Eaters above. Even if the players aren’t directly facing these foes, their influence and authority hangs over the world. Risk is measured as a percentage, the chance that the Risk Eaters will find and dispatch operatives to deal with the group at that moment. Risk comes from badly handled operations: casually inflict violence, create attention, use poor security measures, ignore tradecraft practices. Any of these add to the group’s risk score. As well, the cost for ignoring botches on your Fate dice I mentioned above? Increasing your risk.

Everything Else
I haven’t even gotten to the deeper world-building that takes the implications of the Shard and Cryptomantic technologies and runs with them. Or the large section on handling missions and how tradecraft worlds in a world like this. It’s a substantial core book.

  • Premise: The concept of fantasy hacking excited me, but I also made me wary. I’d seen “hacking” done badly, essentially just a minigame of rolls. I’d also seen forced and thin net analogues. Cryptomancer cuts around that. It assumes a secure system. You don’t run the net. Instead you have to find the real world vulnerabilities, the gaps in the system’s armor, and the points of entry. And most often those will be people.
  • InfoSec: The game’s about information security, but scaled down and presented in a way you can grasp. It makes Private Key/Public Key encryption ideas work with Elves. How crazy is that? It sets up cool ideas and blends with seamlessly with the setting. There’s a spell to “Encrypt” a doorway, creating a maze-barrier someone can’t pass through without the keyphrase. There’s so much more.
  • Writing: The book’s solidly written and compelling. It has a clean and effective layout. The art’s good and consistent throughout. I liked the little bits of fiction and appreciated the organization. It’s a big book as well. Add to that a free 48-page expansion the designer’s put out. He could have easily charged for that, but instead he released it for early adopters.
  • Mechanics: The system works. It’s fun and fast. Combat’s quick and deadly. It takes a page from Dungeon World and similar games: abstracting equipment with tags and offering slimmed down monster templates. As a GM you roll, a pool which can slow things a little. I rolled a table to results and burned through those for the NPCs. That sped things up.
  • Background: It has a good and rich material for the GM. The tools support a long campaign, with players learning how to operate and developing their own styles. The Risk Eater backdrop gives a great hook right out of the gate.
Basically I really dig this game, so the criticisms below are really minor. They’re more things to be aware of when you read the book.

  • Character Sheet: The character sheet’s smartly designed, but on first glance looks hella complicated. It’s solid once you get a grip on the game. Be aware that it may be a little off-putting initially.
  • Missed Rules: Because Cryptomancer isn’t like other systems I know, it took a bit to get a handle on. A few places bury rules. For example the mechanic for ignoring fate die botches isn’t in the resolution section. It’s tucked away in the part on Risk. Willpower’s used for most, if not all spellcasting checks. That’s mentioned in passing under Willpower in the skill list. But it isn’t discussed in the general section on spells. Instead each individual spell states you need to roll that. That worked against my speed prep for the game , I’d read the general magic rules, but had skipped all the specific spells. So when the question "what do you roll?" came up, I flopped through the book looking for a broad rule. So minor, but all of that’s to say that while it’s at heart a simple game, you’ll want to read through it a couple of times before you run.
  • Backstory: This is a heavy world, but players need to have command of a ton of operational details: races, factions, cryptomancy procedures, shard systems, etc. A GM’s going to need to convey that to the players. In my group, and many others I know of, the GM’s the one buying books and occasionally the players. I wish the rules had one or two quick reference handouts for the setting. I pulled my own together, but even that misses important info. I don’t know the best solution to this problem.
  • Death Spiral: The PC’s are doomed. They will generate risk and rise in threat level to the Risk Eaters. These foes will send more and more potent hunters. There’s no mechanism for reducing risk. The book makes a point of that and that the Risk Eaters are too big to be taken down. GMs will have to decide how they want to handle this frame and tone. Players should know the implications going into a campaign.
  • Dungeoning: A couple of times Cryptomancer says it hasn’t forgotten about the hack & slash side of things. it hopes to handle the dungeon delving side equally well. But it’s a dangerous game: characters have a small HP pool and that won’t change much throughout the campaign. It’s closer to something like GURPS Fantasy for scale and lethality. Its approach to monsters and the like is closer to Dungeon World. That’s not a bad thing, but something you should know going in. A classic D&D dungeon might slaughter the party.
  • Adventure: The book contains a sample adventure/campaign starter. If you plan on running it, take a long look at the pre-gens available at the back. The scenario presents the challenges without clear advice about solutions. That makes it more difficult for the GM to visualize and clarify things to the players. The PCs do have the resources to win- odd spells and talents to see them through. But until you really put the two things together it can feel very unclear.
  • Production: The pdf lacks layers. Given that every page has illustrative grey sidebars, that’s a problem for printing. The core book’s giant, clocking in at 400+ pages, a good thing. While I like the printed copy, the paper’s a little thin. There’s some bleed-through for reading. As well the pages have started to do that “curl” that you get from lots of ink and lightweight paper. I should note that my hardcover came with the cover torn away from the spine. I only mention that to say how well and quickly DriveThruRPG responded to email about this. They offered a replacement or, if the damaged book was in usable shape, sending out a printed copy of another book I wanted. Class act!
Cryptomancer’s a great game and one that came out of nowhere. I hadn’t seen much talk about it in my gaming feed. A search shows more discussion of it in connection with InfoSec than RPGs. For a first product, it’s amazingly well produced: smart, complete, and with strong choices about things like the art. It is a planning, investigation, and thinking rpg. That’s not everyone’s bag and it doesn't abstract that. But it’s also one that shows its real strength over time. I highly recommend it.

Cryptomancer on DriveThruRPG
Videos of our AP Sessions